Managed function execution for processing data streams in real time

ABSTRACT

Managed function execution for processing data streams in real time may be. A function that describes one or more operations to be performed with respect to one or more data streams may be received via programmatic interface for a managed stream processing system. Stream processing nodes capable of applying the function may be determined and execution of the one or more operations may be initiated at the stream processing nodes as data records of the data stream are received. Results of the application of the processing function may be provided to one or more destinations specified for the function. Performance metrics may also be collected for the execution of the function and provided to a client that submitted the function.

BACKGROUND

Interconnected devices, such as networked sensors and computing devices,can generate and send data pertinent to various operations,transactions, or other events to remote devices for storage and furtheranalysis. For example, mobile phones can generate data indicating theirlocations, the applications being used by the phone users, and so on, atleast some of which can be collected and analyzed in order to presentcustomized coupons, advertisements and the like to the users. Theanalysis of data collected by surveillance cameras may be useful inpreventing and/or solving crimes, and data collected from sensorsembedded at various location within airplane engines, automobiles orcomplex machinery may be used for various purposes such as preventivemaintenance, improving efficiency and lowering costs.

Large amounts of such data may be generated and sent in streamingfashion so that the data can be captured in real time. However, overtime the volume of streaming data may prove difficult to efficientlyanalyze. Different data formats for data records within data streamscould require different operations to be performed in order to interpretor manipulate the data, making it difficult to utilize a common schemato handle multiple data streams. The volume of data within a data streammay change over time, complicating efforts to acquire the appropriatenumber of resources for efficiently analyzing the data stream.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a logical block diagram that illustrates managed functionexecution for processing data streams in real time, according to atleast some embodiments.

FIG. 2 is a logical block diagram illustrating a provider network thatimplements a stream processing service that provides managed functionexecution for data streams, according to at least some embodiments.

FIG. 3 is a logical block diagram of a stream processing service thatimplements managed function execution for processing data streams inreal time, according to at least some embodiments.

FIG. 4 is a logical block diagram of a stream processing node, accordingto at least some embodiments.

FIG. 5 illustrates interactions between a client and a stream processingservice via a programmatic interface, according to at least someembodiments.

FIG. 6 illustrates interactions between a stream processing node anddifferent destinations to deliver stream processing results, accordingto at least some embodiments.

FIGS. 7A and 7B are examples of a graphical user interface for providinga stream processing function for processing one or more data streams,according to at least some embodiments.

FIG. 8 is a high-level flowchart illustrating various methods andtechniques to provision stream processing nodes for executing a streamprocessing function in real time for a data stream, according to atleast some embodiments.

FIG. 9 is a high-level flowchart illustrating various methods andtechniques to apply a stream processing function at stream processingnodes, according to at least some embodiments.

FIG. 10 is a block diagram illustrating an example computing system thatmay be used in at least some embodiments.

While embodiments are described herein by way of example for severalembodiments and illustrative drawings, those skilled in the art willrecognize that embodiments are not limited to the embodiments ordrawings described. It should be understood, that the drawings anddetailed description thereto are not intended to limit embodiments tothe particular form disclosed, but on the contrary, the intention is tocover all modifications, equivalents and alternatives falling within thespirit and scope as defined by the appended claims. The headings usedherein are for organizational purposes only and are not meant to be usedto limit the scope of the description or the claims. As used throughoutthis application, the word “may” is used in a permissive sense (i.e.,meaning having the potential to), rather than the mandatory sense (i.e.,meaning must). Similarly, the words “include,” “including,” and“includes” mean including, but not limited to.

DETAILED DESCRIPTION

Various embodiments of methods and apparatus to implement managedfunction execution for processing data streams in real time aredescribed. The term “data stream,” as used herein, refers to a sequenceof data records that may be generated by one or more data producers andaccessed by one or more data consumers, where each data record isassumed to be an immutable sequence of bytes representing one or moreattributes. The records of a stream may also be referred to asobservation records, observations, points, or data records herein, andthe data producers may be referred to as streaming data sources. Amanaged stream processing system may provide programmatic interfaces(e.g., application programming interfaces (APIs), web pages or websites, graphical user interfaces, or command-line tools) to executefunctions specified via the programmatic interfaces (e.g., selected,uploaded, or modified via the programmatic interfaces) in various waysand direct the reporting of processing results to one or moredestinations.

A managed stream processing system may determine a data schema andprocessing resources to execute stream processing functions. Streamprocessing functions may be specified according to standard programminglanguages or specifications, such as structure query language (SQL),custom programming or a numerical computation language like Matlab,domain specific languages (which may be defined and implemented by amanaged stream processing system), or input forms or other interfaceelements (e.g., a function generation wizard) which provide a user withthe ability to select input data streams, function operations (e.g.,aggregation, filtering, statistical operations, etc.), and resultdestinations. A managed stream processing system may handle connectingor interfacing with input data streams, selecting or provisioning theappropriate stream processing nodes (or other processing resources)which may execute the specified stream processing function (e.g.,implementing the appropriate execution engines, such as a storage enginethat interprets SQL statements), and reporting results to resultdestinations. In this way, the managed stream processing system mayallow users to connect, parse, and apply a real time schema on raw datastreams.

Executing stream processing functions at the managed stream processingsystem may provide users with capability to quickly build real timecomputations including data filters, transformations, and aggregationswithout burdening users with the additional time to manually managingthe resources to carry out the specified stream processing function.Moreover a managed stream processing system may offer a library ofpredefined stream processing functions or operations to be includedwithin functions which may be customized to build various streamprocessing applications, including business-critical streamingapplications like real time traffic congestion analysis, emergency callmonitoring, fraud detection, and industrial sensor analytics.

FIG. 1 is a logical block diagram that illustrates managed functionexecution for processing data streams in real time, according to atleast some embodiments. Client(s) 140 may provide stream processingfunctions to managed stream processing system 110 via interface 112,which may be a programmatic interface that may be invoked over a networkconnection between client(s) 140 and managed stream processing system110. Managed stream processing system 110 may then implement streamprocessing provisioning 130 to execute the stream processing function onstream processing node(s) 120 so that as data records of data stream 102are received stream processing node(s) 120 may apply the streamprocessing function and provide result(s) 104 to a specified resultdestination.

As noted above, client(s) 140 may specify a stream processing functionto implement different applications. For example, client(s) 140 mayinclude an operation in the stream processing function that selectscertain attributes and then specify operation(s) that perform specificprocessing on the selected attribute (e.g., filtering out theattributes, validating the values of the attributes against knownpatterns, performing time series analytics). Key performance indicators(KPI) are one example of data attributes which may be extracted from adata stream for performing such operations. Client(s) 140 may utilize astream processing function to perform stream pattern generation so thatreal time alerts may be triggered when detecting certain events fromdata stream records or so that additional data may be inserted to enrichthe data conveyed in data records of a data stream. Moreover, client(s)140 may specify stream processing functions that process across multipledata streams in order to perform complex stream processing (e.g.,analyzing temporal patterns between streaming events in differentstreams). Stream processing records may be provided to managed streamprocessing system 110 complete and ready for execution (e.g., identifyinput streams, operations, result destinations, and other information,such as is discussed below with regard to FIG. 5). In some embodiments,clients may configure the performance of the stream processing function(e.g., by providing a distribution scheme to map data from one ormultiple input data streams to a distributed set of stream processingnodes applying a stream processing function).

Once managed stream processing system 110 receives the stream processingfunction, stream processing provisioning 130 may analyze the input datastream(s) 102 to determine a data schema for the data stream(s) 102. Forexample, Stream processing provisioning 130 may read several datarecords of a scheme and determine that each data record has 4attributes, 2 integer values and 2 string values, and label or definethose different attributes so that the different attributes can beevaluated, manipulate, d removed, or otherwise transformed by aprocessing function (e.g., utilizing assigned attribute names as“columns” of able such that SQL queries can be executed that use thedifferent column values). Managed stream processing system 110 may alsoselect appropriate ones of stream processing node(s) 120 to execute thestream processing functions, such as discussed below with regard toFIGS. 3 and 8. For instance, stream processing provisioning 130 maydetermine whether one or multiple stream processing node(s) 120 areneeded to handle the volume of data records that may be received for theidentified input data stream(s). In some embodiments, stream processingnode(s) 120 may be implemented as part of a multi-tenant processingmodel (where stream processing for unrelated stream processing functionsmay be executed by the same node or underlying host) and streamprocessing provisioning 130 may select a stream processing node 120 withthe capacity to execute a received stream processing function. Streamprocessing provisioning 130 may identify processing features orcharacteristics for executing a stream processing function and identifystream processing node(s) 120 capable of providing the specifiedcharacteristics (e.g., network bandwidth or processing speed). Streamprocessing provisioning 130 may also configure network connections orinterfaces with sources of data stream 102 and destinations of result(s)104.

Stream processing node(s) 120 may execute stream processing functions onbehalf of client(s) 140 on data stream(s) 102 without clientintervention or direct management, such as is described in more detailbelow with regard to FIGS. 4 and 9. Stream processing node(s) 120 mayretrieve and/or receive data stream(s) 102 via established connectionsor interfaces configured by stream processing provisioning 130 andimplement one or multiple different execution engines to execute thestream processing function provided by stream processing provisioning130 to stream processing node(s) 120. In some embodiments, streamprocess node(s) 120 may perform any necessary interpretation,compilation, or other form of analysis to execute stream processingfunctions (including evaluating data records to determine a data schemathat maps to stream processing functions), while in other embodiments,stream processing provisioning 130 may provide an executable or otherready to run set of data that stream processing node(s) 120 may execute.Stream processing node(s) 120 may report performance metrics or otherinformation to managed stream processing system 110 and/or to client(s)140 in order to describe the performance of stream processing functionsat stream processing node(s) 120 (e.g., for performance tuning and/orconfiguration).

There are may be many sources of data stream(s) 102. Stream managementservices, such as stream management service 250 discussed below withregard to FIG. 2, can create, manage, and provide access to data streamswhich may be specified as input data streams for stream processingnode(s) 120. Other devices, systems, or services may generate streams ofdata records (e.g., data stores, mobile devices, data logs, or multipledevices, systems, or services of a distributed system) which may beconfigured to provide data streams over a network to stream processingnode(s) 120 for processing. Similarly destinations for result(s) 104 ofstream processing functions may be varied. For instance, some streamprocessing functions may direct result(s) to a data store and anothersystem which may perform responsive actions or invoke other applicationsfor the result(s) 104. FIG. 6, discussed in detail below, providesnumerous examples of destinations for results which may be implemented,in some embodiments.

Please note that previous descriptions are not intended to be limiting,but are merely provided as a logical example of managed functionexecution for processing data streams in real time. Different numbers orcombinations of components, systems, and/or devices may be utilized toexecute stream processing functions on behalf of clients.

This specification begins with a general description of a providernetwork, which may implement a stream processing service that providesmanaged function execution for processing data streams in real time.Then various examples of a stream processing service are discussed,including different components/modules, or arrangements ofcomponents/module that may be employed as part of providing managedfunction execution for processing data streams in real time. A number ofdifferent methods and techniques to implement managed function executionfor processing data streams in real time are then discussed, some ofwhich are illustrated in accompanying flowcharts. Finally, a descriptionof an example computing system upon which the various components,modules, systems, devices, and/or nodes may be implemented is provided.Various examples are provided throughout the specification.

FIG. 2 is a logical block diagram illustrating a provider network thatimplements a stream processing service that provides real time anomalydetection for data streams, according to at least some embodiments.Provider network 200 may be set up by an entity such as a company or apublic sector organization to provide one or more services (such asvarious types of cloud-based computing or storage) accessible via theInternet and/or other networks to clients 210. Provider network 200 mayinclude numerous data centers hosting various resource pools, such ascollections of physical and/or virtualized computer servers, storagedevices, networking equipment and the like (e.g., computing system 1000described below with regard to FIG. 10), needed to implement anddistribute the infrastructure and services offered by the providernetwork 200. In some embodiments, provider network 200 may implement astream processing service 220, described in detail below with regard toFIG. 3, provide computing resources, such as virtual compute service 230and storage services 240, such as object storage services, block-basedstorage services, data warehouse storage services, stream managementservice 250, and/or any other type of network based services 270 (whichmay include various other types of storage, processing, analysis,communication, event handling, visualization, and security services).Clients 210 may access these various services offered by providernetwork 200 via network 280. Likewise network-based services maythemselves communicate and/or make use of one another to providedifferent services. For example, computing resources offered to clients210 in units called “instances,” such as virtual or physical computeinstances or storage instances, may be implemented as data producers ordata consumers for a data stream processed by stream processing service220 and services such as storage service 240, may serve as destinationsfor data records in the data stream, providing virtual block storage forthe compute instances.

As noted above, virtual compute service 230 may offer various computeinstances to clients 210. A virtual compute instance may, for example,comprise one or more servers with a specified computational capacity(which may be specified by indicating the type and number of CPUs, themain memory size, and so on) and a specified software stack (e.g., aparticular version of an operating system, which may in turn run on topof a hypervisor). A number of different types of computing devices maybe used singly or in combination to implement the compute instances ofvirtual compute service 230 in different embodiments, including specialpurpose computer servers, storage devices, network devices and the like.In some embodiments instance clients 210 or other any other user may beconfigured (and/or authorized) to direct network traffic to a computeinstance. In various embodiments, compute instances may attach or map toone or more data volumes provided by a block-based storage service (notillustrated) in order to obtain persistent block-based storage forperforming various operations.

Compute instances may operate or implement a variety of differentplatforms, such as application server instances, Java™ virtual machines(JVMs), special-purpose operating systems, platforms that supportvarious interpreted or compiled programming languages such as Ruby,Perl, Python, C, C++ and the like, or high-performance computingplatforms) suitable for performing client applications, without forexample requiring the client 210 to access an instance. In someembodiments, compute instances have different types or configurationsbased on expected uptime ratios. The uptime ratio of a particularcompute instance may be defined as the ratio of the amount of time theinstance is activated, to the total amount of time for which theinstance is reserved. Uptime ratios may also be referred to asutilizations in some implementations. If a client expects to use acompute instance for a relatively small fraction of the time for whichthe instance is reserved (e.g., 30%-35% of a year-long reservation), theclient may decide to reserve the instance as a Low Uptime Ratioinstance, and pay a discounted hourly usage fee in accordance with theassociated pricing policy. If the client expects to have a steady-stateworkload that requires an instance to be up most of the time, the clientmay reserve a High Uptime Ratio instance and potentially pay an evenlower hourly usage fee, although in some embodiments the hourly fee maybe charged for the entire duration of the reservation, regardless of theactual number of hours of use, in accordance with pricing policy. Anoption for Medium Uptime Ratio instances, with a corresponding pricingpolicy, may be supported in some embodiments as well, where the upfrontcosts and the per-hour costs fall between the corresponding High UptimeRatio and Low Uptime Ratio costs.

Compute instance configurations may also include compute instances witha general or specific purpose, such as computational workloads forcompute intensive applications (e.g., high-traffic web applications, adserving, batch processing, video encoding, distributed analytics,high-energy physics, genome analysis, and computational fluid dynamics),graphics intensive workloads (e.g., game streaming, 3D applicationstreaming, server-side graphics workloads, rendering, financialmodeling, and engineering design), memory intensive workloads (e.g.,high performance databases, distributed memory caches, in-memoryanalytics, genome assembly and analysis), and storage optimizedworkloads (e.g., data warehousing and cluster file systems). Size ofcompute instances, such as a particular number of virtual CPU cores,memory, cache, storage, as well as any other performance characteristic.Configurations of compute instances may also include their location, ina particular data center, availability zone, geographic, location, etc.. . . and (in the case of reserved compute instances) reservation termlength.

Storage service 240 may include various types of storage services, suchas different types of storage schemes. An object-based data store may beimplemented, in various embodiments, to provide highly durable storagefor data objects, such as data records stored as part of a data streammanaged by stream management service 220. For instance, the object-baseddata store may be implemented as a key-value data store, where a dataobject is associated with a unique key. The key for the data object isused to access or manage the data object stored in the object-based datastore. Storage service 240 may also include a data warehouse, in variousembodiments, to set up, operate, and scale a data warehouse in a cloudcomputing environment. Data warehouse clusters hosted by the datawarehouse may provide an enterprise-class database query and managementsystem that allows users to scale the clusters, such as by sending acluster scaling request to a cluster control interface implemented bythe web-service. Scaling clusters may allow users of the web service toperform their data warehouse functions, such as fast queryingcapabilities over structured data, integration with various data loadingand ETL (extract, transform, and load) tools, client connections withbest-in-class business intelligence (BI) reporting, data mining, andanalytics tools, and optimizations for very fast execution of complexanalytic queries such as those including multi-table joins, sub-queries,and aggregation, more efficiently. Storage service 240 may includevarious types of database systems and other data store schemes, such asa NoSQL database or various types of relational database systems. In atleast some embodiments, updates or other interactions with storageservice 240 may be a source for one or multiple data streams forprocessing by stream processing service 220.

Stream management service 250 may provide programmatic interfaces (e.g.,application programming interfaces (APIs), web pages or web sites,graphical user interfaces, or command-line tools) to enable thecreation, configuration and deletion of streams. The programmaticinterfaces may also enable the submission, storage, analysis,transformation and/or retrieval of streaming data records in someembodiments. Some clients of the stream management system may developapplications that directly invoke the stream management systemprogrammatic interfaces in various embodiments. In at least someembodiments, however, in addition to the stream management systeminterfaces, a higher-level abstraction or application-level processingframework may be provided for customers, which may simplify variousaspects of stream processing for those clients that do not wish todevelop applications using the lower-level stream management functionssupported by the stream management system. Such a framework may provideits own programmatic interfaces (built, for example, on top of thestream management system interfaces), enabling customers to focus moreon the business logic to be implemented using stream records than onlower-level stream management operations. The higher-level framework maybe implemented as part of the stream management system to provide fullymanaged data stream.

For example, stream management service 250 may implement a dataingestion system configured to obtain data records of a particular datastream from data producers (e.g., by operating one or multiple ingestionnodes for a data stream). In some embodiments, data records of a streammay be obtained according to a scheme for partitioning the data stream.The partitioning scheme may be selected by a client of stream managementservice 250 for a data stream such that data records are received fromdata producer(s) indicating the particular partition to which the datarecord belongs. However, in some embodiments, a data stream may be fullymanaged by stream management service 250 and data producer(s) may senddata records without any direction for partitioning. Instead, the dataingestion system may assign data records to route the data records toidentified partition. Once ingested, stream management service may storeobtained data records (e.g., on corresponding storage nodes provisionedfor a the data stream). Such storage nodes may record, save, store orotherwise persist the data records on any of various types of storagedevices (which may be performed in accordance with a persistence policyfor the data stream).

In order to retrieve data from the data stream, stream managementservice may provide a retrieval system (e.g., implementing retrievalnodes) that may access the stored data records of the data stream. Insome embodiments, data retrieval may be performed in response to requestfrom consumers (e.g., stream processing nodes that perform processing ondata stream data).

Stream management service 250 may provide an interface that supports oneor more sets of programmatic interfaces (e.g., application programminginterfaces (APIs), web pages or web sites, graphical user interfaces, orcommand-line tools) to enable the creation, configuration and deletionof data streams (both client-managed or fully-managed), as well as thesubmission, storage and retrieval of stream data records in someembodiments. For instance, data producers may be configured to placedata records into a data stream by utilizing a client library providedby stream management service 250 to utilize requests, sending a“putRecord” request to stream management service 250 via the interface.Similarly, data consumer(s) may be configured to access streammanagement service 250 via the interface and utilize the client libraryprovided by stream management service 250 to “getNextRecords” whenexecuting an application to retrieve the next data records to beprocessed in the data stream.

Other network-based services 260 may include various services, includingservices configure networking of client provider network resources(e.g., load balancing), security (e.g., firewalls, access control),communication (e.g., notification or messaging systems), event drivenexecution services, visualization services or services for further dataprocessing. External data stream source(s)/destination(s) 270 mayprovide data streams which may be processed by stream processing service220 and/or serve as destinations for the results generated by streamprocessing service 220. For instance, external data stream sources maybe system that collects crowd sourced information (e.g., traffic ortemperature) and assembles single data stream of the sourced data forprocessing to stream processing service 220. External data streamsource(s)/destination(s) may be a private data store or processingsystem which may operate further on results reported from streamprocessing service 220.

Clients 210 may encompass any type of client configurable to submitrequests to network provider 200. For example, a given client 210 mayinclude a suitable version of a web browser, or may include a plug-inmodule or other type of code module configured to execute as anextension to or within an execution environment provided by a webbrowser. Alternatively, a client 210 may encompass an application suchas a database application (or user interface thereof), a mediaapplication, an office application or any other application that maymake use of compute instances, a data volume 226, or other network-basedservice in provider network 200 to perform various operations. In someembodiments, such an application may include sufficient protocol support(e.g., for a suitable version of Hypertext Transfer Protocol (HTTP)) forgenerating and processing network-based services requests withoutnecessarily implementing full browser support for all types ofnetwork-based data. In some embodiments, clients 210 may be configuredto generate network-based services requests according to aRepresentational State Transfer (REST)-style network-based servicesarchitecture, a document- or message-based network-based servicesarchitecture, or another suitable network-based services architecture.In some embodiments, a client 210 (e.g., a computational client) may beconfigured to provide access to a compute instance or data volume 226 ina manner that is transparent to applications implement on the client 210utilizing computational resources provided by the compute instance orblock storage provided by the data volume 226.

Clients 210 may convey network-based services requests to providernetwork 200 via external network 260. In various embodiments, externalnetwork 280 may encompass any suitable combination of networkinghardware and protocols necessary to establish network-basedcommunications between clients 210 and provider network 200. Forexample, a network 280 may generally encompass the varioustelecommunications networks and service providers that collectivelyimplement the Internet. A network 280 may also include private networkssuch as local area networks (LANs) or wide area networks (WANs) as wellas public or private wireless networks. For example, both a given client210 and provider network 200 may be respectively provisioned withinenterprises having their own internal networks. In such an embodiment, anetwork 280 may include the hardware (e.g., modems, routers, switches,load balancers, proxy servers, etc.) and software (e.g., protocolstacks, accounting software, firewall/security software, etc.) necessaryto establish a networking link between given client 210 and the Internetas well as between the Internet and provider network 200. It is notedthat in some embodiments, clients 210 may communicate with providernetwork 200 using a private network rather than the public Internet.

FIG. 3 is a logical block diagram of a stream processing service thatimplements managed function execution for processing data streams inreal time, according to at least some embodiments. Managed streamprocessing service 220 may receive stream processing functions viainterface 312 and provision one or more processing nodes 370 from a poolof processing nodes 370 to execute the stream processing function. Asillustrated in FIG. 3, managed stream processing service 220 mayimplement control plane 310 to manage the execution of stream processingfunctions at stream processing nodes 370.

In various embodiments, control plane 310 may implement interface 312which may be a programmatic interface invoked by various calls orinteractions by clients of managed stream processing service 220. Forinstance, as discussed below with regard to FIG. 5, a client may send arequest to create a stream processing application that includes a streamprocessing function. This request may be formatted according to an APIcall (e.g., “createStreamProcessor”) and may include as parameters ofthe call one or more operations to perform with respect to the datastream (e.g. query, add, remove, transform, aggregate, calculate, etc.),input data streams (e.g., data stream names, network addresses, or otheridentification information), and result destinations (e.g., data storenames, network addresses or other identification/connection information.Interface 312 may be invoked by a command line interface or may beimplemented as part of a graphical user interface, such as discussedbelow with regard to FIG. 7. Interface 312 may also provide for theuploading of stream processing functions (e.g., written in a codinglanguage or provided as an executable or other object that may performstream processing function).

In at least some embodiments, control plane 310 may implement streamprocessing function interpretation 350. Stream processing interpretation350 may provide various libraries, compilers, or any other kind ofinterpreter that may receive a stream processing function (e.g.,operations, input data streams, destinations, etc.) and generate anexecutable form (e.g., object code, byte code, workflow, or other set ofinstructions). For example, in some embodiments, processing nodes 370may implement a common execution engine so that stream processingfunctioning interpretation 350 may provide an executable that can run onany available processing node. In some embodiments, stream processingfunction interpretation 350 may validate received stream processingfunctions for errors (e.g., same input and result destination), leavinginterpretation and execution to other components, such as executionengines located at processing nodes 370. In various embodiments, streamprocessing function 350 may evaluate input data streams to determine adata scheme for the execution of a stream processing function. Forinstance, stream processing function interpretation may access andanalyze a group of data records to determine a schema for the datastream, including labeling or identifying common or expected attributesin data records, which may be provided back to a client via interface312.

In at least some embodiments, control plane 310 may implement a streamprocessing function library 340 which may provide a collection of commonand/or user submitted stream processing functions (or individualoperations for stream processing functions). For example, streamprocessing functions to filter, aggregate, or generate a rolling averagemay be stored as part of stream processing function library 340. Aclient may select a stream processing function from the library andadapt or customize it for execution (e.g., supply input data streaminformation, result destinations, etc.) via interface 312. In this way,stream processing function library 340 may maintain stream processingfunctions that are common may be easily adapted for different streamprocessing applications.

Processing node provisioning 330 may be implemented as part of controlplane 310, in various embodiments, in order to provision processingnodes for received stream processing functions. In at least someembodiments, processing node provisioning 330 may perform a preliminaryanalysis to determine the processing requirements or configuration for astream processing function. If, for instance, multiple data inputstreams are indicated, then processing node provisioning 330 maydetermine whether one or multiple processing nodes 370 may need to beacquired in order to execute the stream processing function. Ifmultiples stream processing nodes may be determined, then processingnode provisioning 330 may determine a mapping scheme to distribute dataamongst the processing nodes 370 and reconstitute or aggregate resultsfrom individual processing nodes 370 for reporting. Processing nodeprovisioning may, as noted above, identify required performancecharacteristics or other stream processing function requirements andobtain and select the appropriate processing nodes, as discussed belowwith regard to FIG. 8.

Once processing nodes 370 are selected, processing node provisioning 330may configure or obtain the appropriate access credentials to providethe processing nodes 370 a with access to the input data streams andresult destinations. For instance, if security credentials are required,then processing node provisioning may parse information supplied by aclient to managed stream processing service when the stream processingfunction was submitted in order to extract the security credentials forproviding process nodes 370 with access. Processing node provisioning330 may provide the operation(s) and other information to processingnodes 370 in order to initiate execution of the stream processingfunction (e.g., by providing a SQL statement, executable, or otherinstructions for applying the stream processing function), which in someembodiments may be generated by stream processing functioninterpretation 350.

In various embodiments, control plane 310 may implement processing nodemanagement 320 to manage the execution of stream processing functions atprocessing nodes 370. For instance, based on performance metricsreceived via stream processing function performance monitoring 360, suchas metrics that indicate processing utilization, network utilization,memory utilization, or any other computational performance metric, mayindicate that a processing node 370 is unable to keep up with the streamof data records received (e.g., by measuring result output rates, memoryutilization, ingress buffers for network packets, etc.). Processing nodemanagement 320 may request another processing node 370 from processingnode provisioning 330 in order to split the workload for the oneprocessing node among 2 (or more) processing nodes. Various othermanagement functions, such as migrating a stream processing functionfrom one process node to another, changing mappings for partitioned datastreams, or any other real time changes in configuration to theexecution of a stream processing query may be performed by processingnode management 320. In some embodiments, clients may submitreconfiguration requests to control plane 310 to change the executionconfiguration of data streams (e.g., change the number of processingnodes for a stream processing query).

In some embodiments, control plane 310 may implement stream processingfunction performance monitoring 360. Performance monitoring 360 may beimplemented in order to provide feedback to processing node management320 and/or clients of managed stream processing service 220. Forinstance, a function performance report, such as discussed below withregard to FIG. 5 may be generated and sent via interface 312 byperformance monitoring 360.

Managed stream processing service 220 may implement a pool of streamprocessing nodes 370 a through 370 n which may be implemented ondedicated hardware hosts (e.g., such as computing system 1000 in FIG. 10below) or may be implemented as virtual instances (e.g., by provisioningcompute instances of computing service 230 in FIG. 2). FIG. 4 is alogical block diagram of a stream processing node, according to at leastsome embodiments. Stream processing node 400 may retrieve data recordsfor data streams in order to apply a stream processing function (orassigned portion/operation of stream processing function) and deliverresults generated by applying the stream processing function to aspecified destination.

Stream processing node 400 may implement stream data retrieval 410 inorder to interface with a data stream source(s) 460. As noted abovedifferent types of data stream sources may be implemented. A data streamimplemented by a managed stream interface may, for instance, have aninterface that allows stream data retrieval to request data streamrecords 402 individually. Stream data retrieval 410 may periodicallyrequest 402 new data records in the stream (e.g., as part of a pollingbehavior). Throttling, buffer, and other processing rate controls may beimplemented by stream data retrieval 410 in order to prevent streamprocessing node 400 from being overwhelmed. For example, a throttlethreshold may be implemented that limits the number data records thatmay be queued or buffered for processing at stream processing node 400.A timeout or other delay may be performed when the number of datarecords exceeds the throttle threshold so that stream processing node400 does not drop or otherwise fail to process the data records receiveda stream processing node 400. In some embodiments, stream data retrieval410 may be configured to register and listen for data stream recordsacting as a network endpoint for data stream source 460 to automaticallysend data stream records.

Stream processing nodes 400 may implement function application engine(s)420 to perform the operation(s) of the stream processing function ondata records retrieved by stream data retrieval 410. In someembodiments, function application engine(s) 420 may be implemented for aspecific scheme or structure of data records. For example, in someembodiments data records may specify data records in a relational formatwith rows as different data records and columns as different attributes.Function application engine(s) 420 may act as a storage engine (e.g.,SQL engine) that applies the specified operations (e.g., select, add,remove, modify, etc.) to data records according to the data scheme ofthe data records. Thus if function application engine 420 were a SQLstorage engine, for instance, function application engine 420 wouldtreat a data record as a table and perform the specified operations uponattributes of a data records that mapped to different columns of thetable. In some embodiments, function application engine(s) 420 may be anexecution platform (e.g., for executables, workflows, or otherinstructions provided by control plane 310) that parses data records,performs the specified operations, and generates the desired results.Note that the previous examples are not intended to be limiting as manydifferent types of function application engine(s) 420 may be implementedto perform specified operations for a stream processing function. Insome embodiments, operations may rely upon function specific data, suchas function application data 440, to perform operations (e.g., insertingvarious tags, flags, or other information to enrich a data record).Function application data 440 may be stored locally at stream processingnode 400 or may be obtained from a remote data store or service (e.g.,from storage service 240 in FIG. 2).

Stream processing node 400 may implement result reporting 430 to directthe sending of results 404 to specified destinations. In someembodiments, multiple destinations for results may be specified. As withstream data retrieval 410, result reporting 430 may utilize differentprogrammatic interfaces to register with and obtain access to thespecified destinations. Result reporting 430 may, for example, reformatresults 404 into the appropriate request, format, or scheme in order toensure proper delivery of the reported results 404. Result reporting 430may buffer results 404 into fewer messages in order to reduce networktraffic, in some embodiments. In some embodiments, results may be basedon processing function (or operation) state that is updated each time adata records is processed, and only provided at certain times. Forinstance, a running average state for a window of data records may beupdated each time a data record is received, but the running averagevalue may only be provided periodically (e.g., every 30 minutes, 1 hour,etc.) In at least some embodiments, data records that do not conform tothe data scheme (e.g., missing attributes or different types ofattributes, such as when an attribute value is expected to be a stringbut is instead an integer), may be stored, directed, or otherwisereported to an error store, for reconciliation with the data stream(e.g., by a user).

In at least some embodiments, stream processing node 400 may implementperformance reporting 450. Performance reporting 450 may collectutilization, timing, and other performance related statistics for theexecution of a stream processing function. Performance reporting 450 mayperiodically send these performance metrics 406 to stream processingfunction performance monitoring 360 for the various uses discussedabove. In some embodiments, performance reporting 450 may track theperformance metrics and provide them upon request from stream processingperformance monitoring 360 (so that stream processing functionperformance monitoring 360 may implement a sweeper style metricsgathering in order to avoid being overwhelmed with metrics reportingacross a fleet of stream processing nodes 400).

FIG. 5 illustrates interactions between a client and a stream processingservice via a programmatic interface, according to at least someembodiments. Client 500 (which may be a client 210 in FIG. 2) or otherclient of managed stream processing service 220 may be configured toaccess or request actions via interface 312. For instance, a request toexecute a stream processing function 510 may be sent via interface 510to managed stream processing service 220. Request 510 may includeinformation to execute the stream processing function including, butlimited to, input data stream(s) (e.g., providing identifiers, networkaddresses, access information/credentials, etc.), operation(s) to beperformed (e.g., various operations to filter, aggregate, modify,transform, separate, or otherwise manipulate data records, includingvarious analytical statistics which can be calculated or tracked for thedata stream over time), function data (e.g., a lookup table, pointer toa data store, or other information indicating additional data which maybe inserted or utilized to perform specified operations), resultdestination(s) (e.g., providing data objects, data stores, networkaddresses, access information/credentials, data formats, multipledestinations, etc.). In some embodiments, request 510 may include aparticular performance configuration (e.g., specifying a singleprocessing node for performing the stream processing function, adistributed group of processing nodes including a distribution scheme toidentify how the workload for processing the data stream should bedistributed amongst the group of processing nodes). In some embodiments,request 510 may identify performance targets or thresholds for thestream processing function that could be used by managed streamprocessing service to determine a configuration for executing the streamprocessing function or which if exceeded (or not met) would triggerreconfigurations of the stream processing node(s) by managed streamprocessing service 220 (which may automatically determine a differentconfiguration that would satisfy the desired performance).

In at least some embodiments, managed stream processing service 220 mayprovide a function performance report 520 for actively executing streamprocessing functions on behalf of client 500 via interface 312. Forinstance, managed stream processing service 220 may provide periodic(e.g., hourly or daily) performance reports, or may provide performancereport 520 in response to certain events (e.g., failing a performancethreshold or detecting an error event for the stream processingfunction). The function report 520 may include various performancemetric(s) for the execution of the stream processing function, such asvarious kinds of hardware resource utilization (e.g., memory, processor,storage device, or network bandwidth), average processing time per datarecord, or any other indication of performance for the executing streamprocessing function. In at least some embodiments, function performancereport 520 may include various tuning recommendations for reconfiguringthe execution of the stream processing function (e.g., changing thenumber of processing nodes, redistributing the performance of differentoperations among processing nodes, recommending more efficient or moreaccurate operations to replace one or more specified operations in thestream processing function.

In at least some embodiments, client 500 may be able to act upon tuningrecommendations or reconfigure the performance of a stream processingfunction at will by sending a reconfigure performance request 530.Reconfigure performance request 530 may include various parameters, suchas changes or modifications to various operations performed as part ofthe processing operation (e.g., changes to a “SELECT” SQL statement tocreate a more efficient search). In some embodiments, request 530 maymodify or change to different input data stream(s) (e.g., in order toutilize a different data source for applying the stream processingfunction). For those stream processing functions that utilize additionalfunction data to perform operations, changes may be request to modifythe function data used (e.g., swap lookup tables or provide a local copyof frequently accessed data so that a remote copy need not be accessed).

FIG. 6 illustrates interactions between a stream processing node anddifferent destinations to deliver stream processing results, accordingto at least some embodiments. A stream processing node 600 may beconfigured to interact with numerous types of remote systems,components, or devices so that function results 602 may be transmittedto specified destinations. For example, as illustrated in FIG. 6,function results 602 may be provided to a notification service 620 a(which may another network service 260 of provider network 200 in FIG.2). Notification service 620 a may then deliver messages generated basedon results (e.g., errors, goals met, daily status, etc.) instantly toother many other types of systems components, or devices acrossdifferent protocols utilized by applications or users so that pollingfor results 602 need not be performed.

In some embodiments, function results 602 may be provided to a storageservice 620 b (which may be storage service 240 of provider network 200in FIG. 2). For example, the data storage service 620 b may storeresults as a log for subsequent event analysis, a data object for aspecific period of time (e.g., daily or hourly results), a knowledgebase for performing cost-intensive machine learning algorithms, such aspatter recognition or feature selection, or data warehouse for efficientlarge scale data storage and access. In some embodiments, functionresults 602 may be provided to an event handling service 620 c (whichmay another network service 260 of provider network 200 in FIG. 2).Event handling service 620 c may, for instance, run code or otherspecified set of actions to act as an application or backend servicethat automatically runs and scales the code execution for highavailability based on received results 602 (e.g., generating new userprofiles in a data store upon receiving a new user result fromprocessing a data stream). In some embodiments, function results 602 maybe provided to visualization service 620 d (which may be another networkservice 260 of provider network 200 in FIG. 2). Visualization service620 d may take function results 602 and automatically infers data typesand relationships, and recommend, suggest, and/or generatevisualizations of results 602 (e.g., automatically generating graphsvisualizing user age distribution for a given time period provided asfunction results 602 for a data stream).

In some embodiments, function results 602 may be provided as input toanother data stream 620 e (such as a data stream managed by streammanagement service 250 in FIG. 2). For example, certain error eventsidentified as part of function results 602 may be input into a datastream for error events that aggregates error events across multipledifferent sources of data streams for analysis. External destination 620f may be a data store, service, system, component or device external toprovider network 200 which may also receive function results 602. Streamprocessing node 600 may acquire (as part of the provisioning and/orconfiguring of the execution of a stream processing function theappropriate credentials, location, or other information necessary tocommunicate with external destination 620 f.

FIGS. 7A and 7B are examples of a graphical user interface for providinga stream processing function for processing one or more data streams,according to at least some embodiments. Stream processing functioninterface 700 may be implemented as part of one or a series of differentnetwork-based sites (e.g., websites) that provide a graphical userinterface for interacting with a managed stream processing service.Stream processing function interface 700 may itself utilize variousunderlying APIs or other calls to initiate the execution of a streamprocessing function.

In FIG. 7A, in at least some embodiments, stream processing functioninterface 700 may implement a data stream management element 710 whichmay provide various controls, interfaces, or other graphical elements toidentify input data streams. In the example illustrated in FIG. 7A,descriptive information of the data stream including a data stream name(e.g., which may be utilized in various textual function specifications,such as “SELECT*FROM data stream A”) and other data stream specificinformation (e.g., source, format, or partitioning scheme—if any). Userinterface elements to add a data stream 712 or remove a data stream 714may be included to allow users to manage those data streams which may beused as inputs for a stream processing function.

In at least some embodiments, stream processing function interface 700may implement a result destination management element 720 which mayprovide various controls, interfaces, or other graphical elements toidentify result destinations. In the example illustrated in FIG. 7,descriptive information of the destinations including a destination name(e.g., which may be utilized in various textual function specifications,such as “INSERT INTO data store A”) and other data stream specificinformation (e.g., storage scheme, available space, retention policy,notification format, or action type). User interface elements to add adestination 722 or remove a destination 724 may be included to allowusers to manage those destinations which may be used as outputs for astream processing function.

In at least some embodiments, stream processing function interface 700may implement a function data management element 730 which may providevarious controls, interfaces, or other graphical elements to upload,identify, or remove function data. For example, user interface element732 may be selected to upload a lookup table which specifies differentvalues to be inserted or modified for different data records. Similarly,user interface element 534 may allow a user to remove function data thatis no longer utilized or obsolete.

In at least some embodiments, stream processing function interface 700may implement a function specification element 740 which may providevarious controls, interfaces, or other graphical elements to upload,select, specify, and initiate the execution of a stream processingfunction, as illustrated in FIG. 7B. For example, a function, such asfunction 742 may be graphically illustrated to illustrate the variousconnections between stream sources, operations and result destinations.Operations, such as selected operation 748, connections, sources, orresult destinations may be selected, reconfigured, added, or removedfrom function 742 by manipulating the representative graphical elements.User interface elements, such as element 744, may be implemented toallow a user to select previously saved or defined operation (e.g., fromstream processing functions library 340 in FIG. 3) inclusion in function742. Function specification 740 may also implement a user interfaceelement 746 to upload operations (or entire functions). For instance,selecting the upload operation element 746 may initiate a series of userinterface windows or interactions to perform a data transfer from aclient to managed stream processing service 220 that includes a codefile or executable object.

Stream processing function interface 700 may also implement operationspecification 750 to modify operations for a processing function. Editinterface 754 may provide a space to manually enter a stream processingoperation that is new or edit a selected predefined operation, such asselected operation 748 (e.g., change input streams, destinations, ormodify operations). In this way, users can easily modify streamprocessing operations for different applications without writing anentirely new stream processing function. Initiate function processingelement 760 may trigger a request to begin execution of the streamprocessing function by managed stream processing service 220 in variousembodiments.

The examples of managed function execution for processing data streamsin real time as discussed above with regard to FIGS. 2-7 have been givenin regard to a stream processing service and/or other network-basedservices. Various other types or configurations of distributed systemsprocessing data from a data stream may implement these techniques. Forexample, large-scale distributed environments operated by a singlebusiness entity may implement managed function execution for processingdata streams in real time for its own applications. Moreover, differentconfigurations of the various modules, components, systems, and orservices described above that may implement managed function executionfor processing data streams in real time. Thus the stream managementservice discussed above serves as one example context in which many ofthe stream management and processing techniques described herein may beimplemented. However, the techniques discussed below with regard toFIGS. 8 and 9 may be also implemented using the managed streamprocessing service as discussed above.

FIG. 8 is a high-level flowchart illustrating various methods andtechniques to provision stream processing nodes for executing a streamprocessing function in real time for a data stream, according to atleast some embodiments. As indicated at 810, a function may be receivedvia programmatic interface for a data stream that specifies one or moreoperations to be performed upon data records of one or more datastreams. The function may include input data stream(s) (e.g., providingidentifiers, network addresses, access information/credentials, etc.),the operation(s) to be performed (e.g., various operations to filter,aggregate, modify, transform, separate, or otherwise manipulate datarecords, including various analytical statistics which can be calculatedor tracked for the data stream over time), function data (e.g., a lookuptable, pointer to a data store, or other information indicatingadditional data which may be inserted or utilized to perform specifiedoperations), and result destination(s) (e.g., providing data objects,data stores, network addresses, access information/credentials, dataformats, multiple destinations, etc.). The function may be specifiedaccording to standard programming languages or specifications, such asstructure query language (SQL), custom programming or a numericalcomputation language like Matlab, domain specific languages, or inputforms or other interface elements. In at least some embodiments, datarecords of the data stream may be evaluated to determine a data schemefor the data stream.

The processing nodes configured to apply the function may be determinedin various embodiments. For example, as indicate at 820, a determinationmay be made as to whether multiple processing nodes are needed toexecute the function. A client may specify a distributed processingscheme, in various embodiments (e.g., a parallel processing scheme), orthe size or format of data may be analyzed to identify whether a singleprocessing node could perform the operations of the function with aminimum level of performance. If multiple processing nodes are required,in some embodiments, a determination may be made to identify a workloaddistribution scheme for executing the function among the multipleprocessing nodes. For instance, a simple parallel processing scheme maybe utilized where each processing node performs the same operations ondifferent data records. In some embodiments, different operations may beassigned to different processing nodes. For example, processingintensive operations may be parallelized among multiple nodes while anon-intensive operation may be assigned to a single processing node.

As indicated at 830, stream processing node(s) configured to apply thefunction with respect to the data stream may be identified, in variousembodiments. For instance, if the function is specified according to aparticular language (e.g., SQL), the processing nodes that implementexecution engines capable of compiling/interpreting the particularlanguage may be selected. The data scheme determined for the data streammay be used to map the operations of the processing function toattributes of data records in the data stream (e.g., by mappingspecified “columns” in a SQL statement to the appropriate attributes indata records of the data stream). In some embodiments, configured orcapable processing nodes may have certain performance characteristics(e.g., processing bandwidth, network bandwidth, etc.) which satisfycertain performance targets or thresholds specified by a client.

As indicated at 840, the function at the stream processing node(s) maythen be executed such that the operation(s) are performed upon the datarecords of the data stream as the data records are received. Forinstance, the function may be provided to the identified nodes, and thevarious connections established so that data records from the datastreams may be retrieved in order to execute the function.

FIG. 9 is a high-level flowchart illustrating various methods andtechniques to apply a stream processing function at stream processingnodes, according to at least some embodiments. Stream processing nodes,such as stream processing node 400 in FIG. 4 above, may request new datarecords from source(s) of data streams (e.g., by implementing a pollingbehavior to check for new data records periodically). In someembodiments, a throttling threshold may be enforced such that if anumber of data records being currently processed at a stream processingnode exceeds a throttling threshold, then a request for new data recordsmay be delayed. If new data records are received, as indicated by thepositive exit from 920, then the stream processing nodes may apply theprocessing function for the data stream(s) to the new data records inorder to generate a result, as indicated at 930, or other stateinformation maintained for the processing function. The generated resultmay then be sent to a specified destination for the function, asindicated at 940. In some embodiments, results may not be generated foreach data record that is received, but instead may be generated upon theexpiration of a window of time, amount of data, or number of records.For instance, an average attribute value may be updated as part of stateinformation maintained for a data stream as each data record isreceived, but a result for the data stream, such as an average attributevalue for a 30 min period may not be provided until the 30 minute timewindow has passed (based on the updated processing function state).Stream processing nodes may continue to process new data records in thedata stream as they are received so as to provide real time applicationof the processing function in streaming fashion.

The techniques described above may be useful in a number of scenarios.For example, large provider networks may comprise thousands of instancehosts implementing service instances of a number of differentmulti-tenant or single-tenant services for tens of thousands of clientssimultaneously. Monitoring and/or billing agents installed on thevarious instances and hosts may rapidly generate thousands of metricrecords, which may need to be stored and analyzed to produce accuratebilling records, to determine effective provisioning plans for the datacenters of the provider network, to detect network attacks, and thelike. The monitoring records may form an input stream to a managedstream processing service so that the techniques described may beimplemented for the analysis of the collected records. Similarly,applications to collect and analyze large numbers of log records fromnumerous log sources (e.g., application logs from the nodes of adistributed application, or system logs from the hosts or computeinstances at a data center) may also be able to utilize managed streamprocessing services. In at least some environments, the processingoperations for data records may comprise a real-time ETL(Extract-Transform-Load) processing operation (i.e., an operation thattransforms received data records in real time for loading into adestination, instead of doing the transformation offline), or atransformation of data records for insertion into a data warehouse.Using a data stream for loading data into a data warehouse in real timemay avoid the delays that are typically required to clean and curatedata from one or more data sources, before the data can be inserted intoa warehouse for analysis.

A number of different “big data” applications may also be built usingthe SMS and processing techniques. For example, the analysis of trendsin various forms of social media interactions may be performedefficiently using streams. Data collected from mobile phones or tabletcomputers, such as location information of the users, may be managed asstream records. Audio or video information, collected for example from afleet of monitoring cameras may represent another category of streamingdata set that could be collected and processed in a scalable manner,potentially helping prevent attacks of various kinds. Scientificapplications that require analysis of ever-growing data sets, collectedfor example from weather satellites, ocean-based sensors, forest-basedsensors, astronomical telescopes, may also benefit from the streammanagement and processing capabilities described herein.

The methods described herein may in various embodiments be implementedby any combination of hardware and software. For example, in oneembodiment, the methods may be implemented by a computer system (e.g., acomputer system as in FIG. 10) that includes one or more processorsexecuting program instructions stored on a computer-readable storagemedium coupled to the processors. The program instructions may beconfigured to implement the functionality described herein (e.g., thefunctionality of various servers, resource hosts, control planes,managers and/or other components, such as those that implement theblock-based storage service described herein). The various methods asillustrated in the figures and described herein represent exampleembodiments of methods. The order of any method may be changed, andvarious elements may be added, reordered, combined, omitted, modified,etc.

Embodiments of real time anomaly detection in data streams as describedherein may be executed on one or more computer systems, which mayinteract with various other devices. FIG. 10 is a block diagramillustrating an example computer system, according to variousembodiments. For example, computer system 1000 may be configured toimplement storage and/or compute nodes of a compute cluster, a datastores, and/or a client, in different embodiments. Computer system 1000may be any of various types of devices, including, but not limited to, apersonal computer system, desktop computer, laptop or notebook computer,mainframe computer system, handheld computer, workstation, networkcomputer, a consumer device, application server, storage device,telephone, mobile telephone, or in general any type of computing device.

Computer system 1000 includes one or more processors 1010 (any of whichmay include multiple cores, which may be single or multi-threaded)coupled to a system memory 1020 via an input/output (I/O) interface1030. Computer system 1000 further includes a network interface 1040coupled to I/O interface 1030. In various embodiments, computer system1000 may be a uniprocessor system including one processor 1010, or amultiprocessor system including several processors 1010 (e.g., two,four, eight, or another suitable number). Processors 1010 may be anysuitable processors capable of executing instructions. For example, invarious embodiments, processors 1010 may be general-purpose or embeddedprocessors implementing any of a variety of instruction setarchitectures (ISAs), such as the x86, PowerPC, SPARC, or MIPS ISAs, orany other suitable ISA. In multiprocessor systems, each of processors1010 may commonly, but not necessarily, implement the same ISA. Thecomputer system 1000 also includes one or more network communicationdevices (e.g., network interface 1040) for communicating with othersystems and/or components over a communications network (e.g. Internet,LAN, etc.).

In the illustrated embodiment, computer system 1000 also includes one ormore persistent storage devices 1060 and/or one or more I/O devices1080. In various embodiments, persistent storage devices 1060 maycorrespond to disk drives, tape drives, solid state memory, other massstorage devices, block-based storage devices, or any other persistentstorage device. Computer system 1000 (or a distributed application oroperating system operating thereon) may store instructions and/or datain persistent storage devices 1060, as desired, and may retrieve thestored instruction and/or data as needed. For example, in someembodiments, computer system 1000 may host a storage system server node,and persistent storage 1060 may include the SSDs attached to that servernode.

Computer system 1000 includes one or more system memories 1020 that areconfigured to store instructions and data accessible by processor(s)1010. In various embodiments, system memories 1020 may be implementedusing any suitable memory technology, (e.g., one or more of cache,static random access memory (SRAM), DRAM, RDRAM, EDO RAM, DDR 10 RAM,synchronous dynamic RAM (SDRAM), Rambus RAM, EEPROM,non-volatile/Flash-type memory, or any other type of memory). Systemmemory 1020 may contain program instructions 1025 that are executable byprocessor(s) 1010 to implement the methods and techniques describedherein. In various embodiments, program instructions 1025 may be encodedin platform native binary, any interpreted language such as Java™byte-code, or in any other language such as C/C++, Java™, etc., or inany combination thereof. For example, in the illustrated embodiment,program instructions 1025 include program instructions executable toimplement the functionality of a stream processing node, in differentembodiments. In some embodiments, program instructions 1025 mayimplement multiple separate clients, nodes, and/or other components.

In some embodiments, program instructions 1025 may include instructionsexecutable to implement an operating system (not shown), which may beany of various operating systems, such as UNIX, LINUX, Solaris™, MacOS™,Windows™, etc. Any or all of program instructions 1025 may be providedas a computer program product, or software, that may include anon-transitory computer-readable storage medium having stored thereoninstructions, which may be used to program a computer system (or otherelectronic devices) to perform a process according to variousembodiments. A non-transitory computer-readable storage medium mayinclude any mechanism for storing information in a form (e.g., software,processing application) readable by a machine (e.g., a computer).Generally speaking, a non-transitory computer-accessible medium mayinclude computer-readable storage media or memory media such as magneticor optical media, e.g., disk or DVD/CD-ROM coupled to computer system1000 via I/O interface 1030. A non-transitory computer-readable storagemedium may also include any volatile or non-volatile media such as RAM(e.g. SDRAM, DDR SDRAM, RDRAM, SRAM, etc.), ROM, etc., that may beincluded in some embodiments of computer system 1000 as system memory1020 or another type of memory. In other embodiments, programinstructions may be communicated using optical, acoustical or other formof propagated signal (e.g., carrier waves, infrared signals, digitalsignals, etc.) conveyed via a communication medium such as a networkand/or a wireless link, such as may be implemented via network interface1040.

In some embodiments, system memory 1020 may include data store 1045,which may be configured as described herein. In general, system memory1020 (e.g., data store 1045 within system memory 1020), persistentstorage 1060, and/or remote storage 1070 may store data blocks, replicasof data blocks, metadata associated with data blocks and/or their state,configuration information, and/or any other information usable inimplementing the methods and techniques described herein.

In one embodiment, I/O interface 1030 may be configured to coordinateI/O traffic between processor 1010, system memory 1020 and anyperipheral devices in the system, including through network interface1040 or other peripheral interfaces. In some embodiments, I/O interface1030 may perform any necessary protocol, timing or other datatransformations to convert data signals from one component (e.g., systemmemory 1020) into a format suitable for use by another component (e.g.,processor 1010). In some embodiments, I/O interface 1030 may includesupport for devices attached through various types of peripheral buses,such as a variant of the Peripheral Component Interconnect (PCI) busstandard or the Universal Serial Bus (USB) standard, for example. Insome embodiments, the function of I/O interface 1030 may be split intotwo or more separate components, such as a north bridge and a southbridge, for example. Also, in some embodiments, some or all of thefunctionality of I/O interface 1030, such as an interface to systemmemory 1020, may be incorporated directly into processor 1010.

Network interface 1040 may be configured to allow data to be exchangedbetween computer system 1000 and other devices attached to a network,such as other computer systems 1090, for example. In addition, networkinterface 1040 may be configured to allow communication between computersystem 1000 and various I/O devices 1050 and/or remote storage 1070.Input/output devices 1050 may, in some embodiments, include one or moredisplay terminals, keyboards, keypads, touchpads, scanning devices,voice or optical recognition devices, or any other devices suitable forentering or retrieving data by one or more computer systems 1000.Multiple input/output devices 1050 may be present in computer system1000 or may be distributed on various nodes of a distributed system thatincludes computer system 1000. In some embodiments, similar input/outputdevices may be separate from computer system 1000 and may interact withone or more nodes of a distributed system that includes computer system1000 through a wired or wireless connection, such as over networkinterface 1040. Network interface 1040 may commonly support one or morewireless networking protocols (e.g., Wi-Fi/IEEE 802.11, or anotherwireless networking standard). However, in various embodiments, networkinterface 1040 may support communication via any suitable wired orwireless general data networks, such as other types of Ethernetnetworks, for example. Additionally, network interface 1040 may supportcommunication via telecommunications/telephony networks such as analogvoice networks or digital fiber communications networks, via storagearea networks such as Fibre Channel SANs, or via any other suitable typeof network and/or protocol. In various embodiments, computer system 1000may include more, fewer, or different components than those illustratedin FIG. 10 (e.g., displays, video cards, audio cards, peripheraldevices, other network interfaces such as an ATM interface, an Ethernetinterface, a Frame Relay interface, etc.)

It is noted that any of the distributed system embodiments describedherein, or any of their components, may be implemented as one or morenetwork-based services. For example, a compute cluster within acomputing service may present computing and/or storage services and/orother types of services that employ the distributed computing systemsdescribed herein to clients as network-based services. In someembodiments, a network-based service may be implemented by a softwareand/or hardware system designed to support interoperablemachine-to-machine interaction over a network. A network-based servicemay have an interface described in a machine-processable format, such asthe Web Services Description Language (WSDL). Other systems may interactwith the network-based service in a manner prescribed by the descriptionof the network-based service's interface. For example, the network-basedservice may define various operations that other systems may invoke, andmay define a particular application programming interface (API) to whichother systems may be expected to conform when requesting the variousoperations. though

In various embodiments, a network-based service may be requested orinvoked through the use of a message that includes parameters and/ordata associated with the network-based services request. Such a messagemay be formatted according to a particular markup language such asExtensible Markup Language (XML), and/or may be encapsulated using aprotocol such as Simple Object Access Protocol (SOAP). To perform anetwork-based services request, a network-based services client mayassemble a message including the request and convey the message to anaddressable endpoint (e.g., a Uniform Resource Locator (URL))corresponding to the network-based service, using an Internet-basedapplication layer transfer protocol such as Hypertext Transfer Protocol(HTTP).

In some embodiments, network-based services may be implemented usingRepresentational State Transfer (“RESTful”) techniques rather thanmessage-based techniques. For example, a network-based serviceimplemented according to a RESTful technique may be invoked throughparameters included within an HTTP method such as PUT, GET, or DELETE,rather than encapsulated within a SOAP message.

Various embodiments may further include receiving, sending or storinginstructions and/or data implemented in accordance with the foregoingdescription upon a computer-accessible medium. Generally speaking, acomputer-accessible medium may include storage media or memory mediasuch as magnetic or optical media, e.g., disk or DVD/CD-ROM, volatile ornon-volatile media such as RAM (e.g. SDRAM, DDR, RDRAM, SRAM, etc.),ROM, etc., as well as transmission media or signals such as electrical,electromagnetic, or digital signals, conveyed via a communication mediumsuch as network and/or a wireless link.

The various methods as illustrated in the Figures and described hereinrepresent exemplary embodiments of methods. The methods may beimplemented in software, hardware, or a combination thereof. The orderof method may be changed, and various elements may be added, reordered,combined, omitted, modified, etc.

Various modifications and changes may be made as would be obvious to aperson skilled in the art having the benefit of this disclosure. It isintended to embrace all such modifications and changes and, accordingly,the above description to be regarded in an illustrative rather than arestrictive sense.

What is claimed is:
 1. A system, comprising: a plurality of computenodes, respectively comprising at least one processor and a memory,wherein the plurality of compute nodes implement a managed streamprocessing system comprising a control plane and a plurality of streamprocessing nodes; the control plane, configured to: receive a request toapply a processing function to a data stream; identify one or more ofthe stream processing nodes to apply the processing function; configurethe one or more stream processing nodes to apply the processingfunction; and initiate execution of the processing function at the oneor more stream processing nodes such that the processing function isapplied to data records of the data stream as the data records arereceived at the one or more stream processing nodes.
 2. The system ofclaim 1, wherein the one or more stream processing nodes are configuredto: request new data records for the data stream; upon receipt of thenew data records: apply the processing function to update a state forthe processing function; based on the state for the processing function,generate a result; and send the result to at least one resultdestination specified for the processing function.
 3. The system ofclaim 1, wherein the processing function is received from a client ofthe managed stream processing system comprising, and wherein the controlplane is further configured to: collect one or more performance metricsfor the execution of the processing function at the one or moreprocessing nodes; and send the one or more performance metrics to theclient.
 4. The system of claim 1, wherein the managed stream processingsystem is a network based service implemented as part of a providernetwork and wherein the data stream is produced by another network-basedservice implemented as part of the provider network.
 5. A method,comprising: performing, by one or more computing devices: receiving, viaa programmatic interface, a function for a data stream that specifiesone or more operations to be performed upon data records of a datastream; determining one or more stream processing nodes configured toapply the function with respect to the data stream; and executing thefunction at the one or more stream processing nodes such that the one ormore operations are performed upon the data records of the data streamas the data records are received at the one or more stream processingnodes.
 6. The method of claim 5, wherein the one or more streamprocessing nodes are a plurality of stream processing nodes, and whereinthe method further comprises determining a workload distribution schemefor executing the function at the plurality of stream processing nodes.7. The method of claim 5, wherein the function is received as part of arequest from a client, and wherein the request further specifies adistributed configuration for executing the function among the one ormore stream processing nodes.
 8. The method of claim 5, whereinexecuting the function at the one or more stream processing nodescomprises: sending, from the one or more stream processing nodes, arequest for new data records for the data stream to a data stream sourcefor the data stream; upon receiving the new data records for the datastream, performing, by the one or more stream processing nodes, the oneor more operations of the function to generate a result; and sending,from the one or more stream processing nodes, the result to at least oneresult destination specified for the processing function.
 9. The methodof claim 5, wherein the function is received from a client, and whereinthe method further comprises: collecting one or more performance metricsfor the execution of the function at the one or more processing nodes;and sending the one or more performance metrics to the client.
 10. Themethod of claim 9, further comprising: based, at least in part, on theone or more performance metrics, reconfiguring the execution of thefunction at the one or more processing nodes.
 11. The method of claim 5,wherein the function specifies that the one or more operations are to beperformed upon data records of another one or more data streams inaddition to the data stream such that executing the function at the oneor more stream processing nodes performs the one or more operations withrespect to the data records of the additional one or more data streams.12. The method of claim 11, wherein the one or more operations comprisean aggregation of attribute values from data records of the data streamand the additional one or more data streams.
 13. The method of claim 5,wherein the programmatic interface for receiving the function is invokedby a graphical user interface (GUI).
 14. A non-transitory,computer-readable storage medium, storing program instructions that whenexecuted by one or more computing devices cause the one or morecomputing devices to implement: receiving, via a programmatic interface,a processing function for a data stream; provisioning one or more streamprocessing nodes capable of applying the processing function withrespect to the data stream; initiating execution of the processingfunction at the one or more stream processing nodes such that theprocessing function is applied to data records of the data stream as thedata records are received at the one or more stream processing nodes.15. The non-transitory, computer-readable storage medium of claim 14,wherein the processing function is received from a client and whereinthe processing function is a modified version of a predefined processingfunction provided to the client via the programmatic interface.
 16. Thenon-transitory, computer-readable storage medium of claim 14, whereinthe program instructions cause the one or more computing devices tofurther implement: delaying retrieval of one or more additional datarecords at the one or more stream processing nodes upon exceeding athrottling threshold for ingesting data records of the data stream. 17.The non-transitory, computer-readable storage medium of claim 14,wherein at least one operation of the processing function is specifiedaccording to Structured Query Language (SQL).
 18. The non-transitory,computer-readable storage medium of claim 14, wherein the programinstructions further cause the one or more computing devices toimplement sending results generated from the application of theprocessing function to a result destination specified for the processingfunction.
 19. The non-transitory, computer-readable storage medium ofclaim 14, wherein the program instructions cause the one or morecomputing devices to further implement: prior to the execution of theprocessing function, evaluating data records of the data stream todetermine a schema for the data records of the data stream, wherein oneor more operations of the processing function are applied to the datarecords of the data stream according to the schema.
 20. Thenon-transitory, computer-readable storage medium of claim 19, whereinthe program instructions cause the one or more computing instructions toimplement: identifying, at the one or more stream processing nodes, adata record of the data stream that is different from the schema for thedata records of the data stream; and sending, from the one or morestream processing nodes, the data record to a different resultdestination than a result destination specified for the data stream.